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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )Q Responsive to communication(s) filed on . 



2a)S This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 
Disposition of Claims 

4) ^ Claim(s) 1-18 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) S Claim(s) 6.7.72 and 18 is/are allowed. 

6) ^ Claim(s) 1-5.8-11 and 13-17 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

11) D The proposed drawing correction filed on is: a)D approved b)D disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) D The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

13) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a)D All b)D Some*c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 119(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121. 
Attachment(s) 

1 ) □ Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-413) Paper No(s). . 

2) CD Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) O Notice of Informal Patent Application (PTO-152) 

3) D Information Disclosure Statement(s) (PTO-1449) Paper No(s) . 6) D Other: 
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DETAILED ACTION 



Claim Rejections - 35 USC §103 



1 . The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claims 1-5, 8-11, 13-17 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
(Yerxa and Karve) in view of Bott. 

3. As per claims 1, 4-5, 8-9, 13, Yerxa teaches that Java has a Java Virtual Machine, that 
consists of three parts, one of which is the security manager(SM, i.e. security association 
manger). Yerxa teaches that the security manger monitors file access, system I/O, network I/O, 
etc. . .(see, pg. 2). Further, Yerxa teaches that when an applet performs one of the above actions, 
it first consults the SM for approval(see pg. 2). Also, Yerxa teaches that the SM decides if the 
action is permissible based on the origin of the application or applet(see pg. 2). Therefore, the 
Examiner asserts that Yerxa provides security against unauthorized access when the applet 
performs one of the above actions. Yerxa teaches that whenever a possibly dangerous function is 
called from within the applet or application, the SM grants or denies access to specific resources 
based on the origin of the application or applet. Further, Yerxa teaches that the administrator can 
restrict access to an applet based on its digital signature. Therefore, the Examiner asserts that 
security manager determines the origin of the application by checking the digital signature. The 
Examiner asserts that Yerxa teaches receiving a digital signature at a security manager, because 
the security manger determines the origin of the application, and Yerxa teaches that applications 
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have digital signatures, thus Yerxa teaches receiving a digital signature at a security manger. 
Yerxa teaches certain applets are given more access based on where they reside in the 
computer(see pg. 2). Yerxa also teaches that users may grant more access to certain applets. 
Therefore, the Examiner asserts that Yerxa does disclose access levels. The Examiner asserts 
that Yerxa does disclose a digital signature associated with the applet(see pg. 3). Therefore, an 
applet is associated with an access level. 

4. Although Yerxa is silent on the code or key that is used with a digital signature. The 
Examiner takes Official Notice that it is well-known in the art of digital signatures, that a key(i.e. 
code) pair is used for encryption and decryption, the motivation is that integrity is insured 
because one would need the corresponding key in order to decrypt. Proof that a digital signature 
has a corresponding pair can be taught in Karve. Karve teaches that an applet with a digital 
signature a public and private key. Also, Karve teaches that something can be encrypted with a 
public key, and decrypted with a corresponding private key(see pg. 3 of Karve). Therefore, the 
Examiner asserts that Karve teaches an encryption code and de-encryption code. 

5. Further, Karve discloses that the browser verifies the code and then the JVM allows the 
applet to run on the client machine. The Examiner asserts that the security manager is inside of 
the browser. Furthermore, the SM authenticates the de-encrypted digital signature, because 
Karve states that the browser verifies the code, and the code as taught in Yerxa and Karve has a 
digital signature, than the Examiner asserts Yerxa and Karve teach that the SM authenticates the 
de-encrypted digital signature; and the SM de-encrypted the digital signature with the de- 
encryption code(see above for explanation). 
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6. However, Yerxa and Karve are silent on the SM requesting a de-encryption code, and 
requesting allowed operations associated with the authenticated signature. The Examiner looks 
towards Bott. It would have been obvious to modify Yerxa and Karve with Bott, the motivation 
is that how does the security manager know the certificate is legitimate? Bott teaches that the 
certificate authority checks the digital signature on the certificate against the secure certificate it 
originally issued. Furthermore, Bott teaches that if the certificate is valid the browser used the 
key(i.e. code) to do whatever task. Therefore, the Examiner asserts that Bott teaches SM 
requesting a de-encryption code, because the CA(i.e. certificate authority) in Bott has the 
corresponding key(i.e. de-encryption code), and the browser uses this code to perform task or 
allowed operations(see Bott). 

7. As per claims 2, 10, 14 wherein the network device includes a Java enabled device, is not 
explicitly taught; however, it is implicit because Yerxa teaches that Java is used. Therefore, the 
Examiner asserts that there is a Java enabled device. 

8. As per claims 3,11,16-17, the Examiner takes Official Notice that a de-encryption code 
includes a public key certificate associated with a private key, the motivation is that integrity is 
issued because in order to decrypt one must have the de-encryption code. The Examiner asserts 
that a private key and public key, can be used to encrypt and decrypt respectively or decrypt and 
encrypt respectively, this is taught by Schneier(see pg. 37). 

9. As per claim 15, the Examiner asserts that a downloadable file is an applet or application, 
and Yerxa taught above teaches of digital signatures. 

10. Claims 6-7, 12, 18 are allowable for the feature of a policy server receiving a request for 
allowed operations associated with the digital signature, comparing the authenticated signature 
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with information stored on the policy server; and policy server sending a response to the SAM 
indicating an access level corresponding to the authenticated signature. As per prior art of 
Yerxa, Bott, and Karve, none of these teach the limitations above. More specifically, in prior art, 
and specifically the art that was applied fails to disclose a policy server, the art discloses a 
security manager(SAM) that receives all code, and has a digital signature associated with it, the 
SAM denies and allows request to resources based on the origin of the code, in prior art there is 
no suggesting or disclosing of a policy server cooperating with the SAM, the SAM handles all 
comparing of the signature, and determing of the access level, because especially in the prior art 
of Java the SAM executes inside the sandbox, and the SAM monitors the code. 



1 1 . The Applicant states that Yerxa and Bott do not disclose the claim limitations of claims 1 , 
8, and 13. Further, the Applicant states Yerxa and Botts does not suggest using a de-encryption 
digital signature to obtain an access level for a portion of program code. 

12. First, the Applicant states that Yerxa does not suggest or disclose providing security 
against unauthorized access to internal resources. The Examiner disagrees with the Applicant. 
The system manager of Yerxa monitors system I/O, Network l/0(see pg. 2). The system 
manager of Yerxa determines which applets are allowed access based on the origin, and accepts 
or reject access to specific resources based on the origin, and verifies the origin based on the 
digital signature. 

13. Second, the Applicant is urged to look at previous rejection, the Examiner rejected claims 
(Yerxa and Karve) in view of Botts(see pg. 2 of previous rejection). Yerxa disclosed a digital 
signature(see pg. 3), but did not disclose the components that make up the digital signature. The 
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Examiner look towards Karve to provide details of what components make up a digital signature. 
Karve teaches that an applet with a digital signature has a key pair, public and private key. 
Therefore, the Examiner asserted that Karve teaches a encryption code and de-encryption 
code(see pg. 3 of Karve, and pg. 3 of previous rejection). 

14. Third, in regards to the access level. The Examiner disagrees with Applicant's remarks 
that Yerxa does not teach an access level. Yerxa teaches certain applets are given more access 
based on where they reside in the computer(see pg. 2). Yerxa also teaches that users may grant 
more access to certain applets. Therefore, the Examiner asserts that Yerxa does disclose access 
levels. The Examiner asserts that Yerxa does disclose a digital signature associated with the 
applet(see pg. 3). Therefore, an applet is associated with an access level. 

15. Lastly, the Applicant states that Yerxa teaches away from the use of digital signatures. 
The Examiner disagrees, although Yerxa teaches one aspect of digital signatures being risky, 
Yerxa does not teach not including a digital signature to verify code. Yerxa teaches that a better 
byte-code verifier will lessen security risks. 



16. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
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will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jenise E Jackson whose telephone number is (703) 306-0426. 
The examiner can normally be reached on M-Th (6:00 a.m. - 3:30 p.m.) alternate Friday's. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (703) 305-9648. The fax phone numbers for the 
organization where this application or proceeding is assigned are (703) 305-0040 for regular 
communications and (703) 308-6306 for After Final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703) 305-3900. 



Conclusion 





December 15, 2003 



GILBERT0 BARRON 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 



